DDOS Detection Engine Using Segmented Machine Learning Analysis

Resolve Bottlenecks,
Find Innovative Solutions
Generate Solutions

Solution Overview

Problem

Detecting distributed denial of service (DDOS) attacks on computer systems is challenging due to the large number of attacking devices and illegitimate network traffic, making it difficult to differentiate between legitimate and malicious network traffic in real-time.

Innovation Solution

A distributed denial of service detection engine is implemented, comprising a first and second DDOS analysis engine that perform real-time and detailed analyses of network traffic features using machine learning techniques, such as clustering algorithms and support vector machines, to classify traffic as malicious or benign, and identify potential DDOS attacks.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Speed

If real-time analysis of network traffic is performed to detect DDOS attacks, then detection speed is improved, but detection precision deteriorates due to the large volume of traffic data

Engineering Contradiction:
Improvedetection speedVSAvoiddetection precision
Core Design Contradiction:
SpeedVSMeasurement precision

Solution Approach 1:

The detection system is divided into multiple specialized analysis engines (first DDOS analysis engine and second DDOS analysis engine), each handling specific aspects of traffic analysis. This segmentation allows parallel processing of traffic data, maintaining high detection speed while improving precision through specialized analysis of different traffic characteristics.

Inventive Principle:
Principle #1Segmentation

Solution Approach 2:

The patent introduces intermediary components including a feature extraction module that preprocesses raw traffic data into relevant features, and a machine learning classifier that acts as an intermediary between raw data and detection results. This intermediary processing pipeline enables efficient real-time analysis while maintaining high detection accuracy through selective feature analysis.

Inventive Principle:
Principle #24Intermediary (Mediator)

2Measurement precision

If multiple analysis engines are deployed to improve detection accuracy, then detection precision is improved, but system complexity increases

Engineering Contradiction:
Improvedetection precisionVSAvoidsystem complexity
Core Design Contradiction:
Measurement precisionVSDevice complexity

Solution Approach 1:

The system is segmented into modular analysis engines with distinct responsibilities - the first engine handles real-time anomaly detection while the second engine performs detailed protocol analysis. This modular segmentation improves detection precision through multiple analysis perspectives while managing complexity through clear separation of concerns and independent engine deployment.

Inventive Principle:
Principle #1Segmentation

Solution Approach 2:

The analysis engines are designed with universal capabilities to handle multiple types of network protocols and attack vectors through a common architecture. This multi-functionality allows the system to maintain high detection precision across diverse attack scenarios while reducing overall system complexity by avoiding the need for separate specialized systems for each attack type.

Inventive Principle:
Principle #6Universality (Multi-functionality)

3Measurement precision

If machine learning techniques are applied to classify traffic, then detection precision is improved, but processing time increases

Engineering Contradiction:
Improvedetection precisionVSAvoidprocessing time
Core Design Contradiction:
Measurement precisionVSLoss of time

Solution Approach 1:

The system performs preliminary feature extraction and preprocessing of network traffic data before applying machine learning classification. By pre-processing the data to extract only the most relevant features and organizing them in advance, the system achieves high detection precision through sophisticated classification while minimizing processing time during the actual attack detection phase.

Inventive Principle:
Principle #10Preliminary action

Solution Approach 2:

The patent applies machine learning techniques selectively to the most critical and informative features of network traffic rather than analyzing all traffic characteristics in full detail. This partial action approach maintains high detection precision by focusing computational resources on the most discriminative features while reducing overall processing time by avoiding exhaustive analysis of less relevant data.

Inventive Principle:
Principle #16Partial or excessive action

Data Source

PatentEP2769508B1System and method for detection of denial of service attacks
Publication Date: 2018.12.05 MCAFEE LLC
  • EP2769508B1 patent drawingFigure 1~2
  • EP2769508B1 patent drawingFigure 3~4
  • EP2769508B1 patent drawingFigure 5

AI summary

Systems and methods for detecting a denial of service attack are disclosed. These may include receiving a plurality of web log traces from one of a plurality of web servers; extracting a first set of features from the plurality of web log traces; applying a first machine learning technique to the first set of features; producing a first plurality of user classifications for communication to the web server; extracting a second set of features from the plurality of web log traces; applying a second machine learning technique to the second set of features; producing a second plurality of user classification for communication to the web server; communicating the first plurality of user classifications to the web server based at least on the plurality of web log traces; and communicating the second plurality of user classifications to the web server based at least on the plurality of web log traces.